Escaping HTML means swapping the characters a browser reads as markup for entities: & becomes &, < becomes < and > becomes >. Inside attribute values, quotes need escaping too. Paste text below to escape or unescape it, or search the symbol table and copy any entity as a name, number or CSS value.
| Character | Entity | When it must be escaped |
|---|---|---|
| & | & | Always in text, when it could start a reference |
| < | < | Always in text content |
| > | > | Good practice everywhere; required in a few contexts |
| " | " | Inside attribute values wrapped in double quotes |
| ' | ' or ' | Inside attribute values wrapped in single quotes |
Updated
A two-way converter for whole blocks of text, plus a searchable list of the symbols people actually reach for: quotes, dashes, spaces, currency, maths, arrows, Greek letters and emoji. Every row copies four ways.
| Code point | Name | Decimal | Hex | CSS content | Group |
|---|---|---|---|---|---|
| U+0026 | & | & | & | "\26" | Must escape |
| U+003C | < | < | < | "\3C" | Must escape |
| U+003E | > | > | > | "\3E" | Must escape |
| U+0022 | " | " | " | "\22" | Must escape |
| U+0027 | ' | ' | ' | "\27" | Must escape |
| U+00A0 | |   |   | "\A0" | Spaces and invisible |
| U+2002 |   |   |   | "\2002" | Spaces and invisible |
| U+2003 |   |   |   | "\2003" | Spaces and invisible |
| U+2009 |   |   |   | "\2009" | Spaces and invisible |
| U+00AD | ­ | ­ | ­ | "\AD" | Spaces and invisible |
| U+200D | ‍ | ‍ | ‍ | "\200D" | Spaces and invisible |
| U+200C | ‌ | ‌ | ‌ | "\200C" | Spaces and invisible |
| U+2026 | … | … | … | "\2026" | Punctuation |
| U+2013 | – | – | – | "\2013" | Punctuation |
| U+2014 | — | — | — | "\2014" | Punctuation |
| U+2018 | ‘ | ‘ | ‘ | "\2018" | Punctuation |
| U+2019 | ’ | ’ | ’ | "\2019" | Punctuation |
| U+201C | “ | “ | “ | "\201C" | Punctuation |
| U+201D | ” | ” | ” | "\201D" | Punctuation |
| U+00AB | « | « | « | "\AB" | Punctuation |
| U+00BB | » | » | » | "\BB" | Punctuation |
| U+2022 | • | • | • | "\2022" | Punctuation |
| U+00B7 | · | · | · | "\B7" | Punctuation |
| U+00A1 | ¡ | ¡ | ¡ | "\A1" | Punctuation |
| U+00BF | ¿ | ¿ | ¿ | "\BF" | Punctuation |
| U+00A7 | § | § | § | "\A7" | Punctuation |
| U+00B6 | ¶ | ¶ | ¶ | "\B6" | Punctuation |
| U+2020 | † | † | † | "\2020" | Punctuation |
| U+2021 | ‡ | ‡ | ‡ | "\2021" | Punctuation |
| U+2032 | ′ | ′ | ′ | "\2032" | Punctuation |
| U+2033 | ″ | ″ | ″ | "\2033" | Punctuation |
| U+20AC | € | € | € | "\20AC" | Currency |
| U+00A3 | £ | £ | £ | "\A3" | Currency |
| U+00A5 | ¥ | ¥ | ¥ | "\A5" | Currency |
| U+00A2 | ¢ | ¢ | ¢ | "\A2" | Currency |
| U+00A4 | ¤ | ¤ | ¤ | "\A4" | Currency |
| U+20B9 | (no name) | ₹ | ₹ | "\20B9" | Currency |
| U+20BF | (no name) | ₿ | ₿ | "\20BF" | Currency |
| U+20A9 | (no name) | ₩ | ₩ | "\20A9" | Currency |
| U+00D7 | × | × | × | "\D7" | Math |
| U+00F7 | ÷ | ÷ | ÷ | "\F7" | Math |
| U+00B1 | ± | ± | ± | "\B1" | Math |
| U+2260 | ≠ | ≠ | ≠ | "\2260" | Math |
| U+2264 | ≤ | ≤ | ≤ | "\2264" | Math |
| U+2265 | ≥ | ≥ | ≥ | "\2265" | Math |
| U+2248 | ≈ | ≈ | ≈ | "\2248" | Math |
| U+221E | ∞ | ∞ | ∞ | "\221E" | Math |
| U+2211 | ∑ | ∑ | ∑ | "\2211" | Math |
| U+221A | √ | √ | √ | "\221A" | Math |
| U+2212 | − | − | − | "\2212" | Math |
| U+00BD | ½ | ½ | ½ | "\BD" | Math |
| U+00BC | ¼ | ¼ | ¼ | "\BC" | Math |
| U+00BE | ¾ | ¾ | ¾ | "\BE" | Math |
| U+00B0 | ° | ° | ° | "\B0" | Math |
| U+2030 | ‰ | ‰ | ‰ | "\2030" | Math |
| U+00B2 | ² | ² | ² | "\B2" | Math |
| U+00B3 | ³ | ³ | ³ | "\B3" | Math |
| U+00B5 | µ | µ | µ | "\B5" | Math |
| U+2190 | ← | ← | ← | "\2190" | Arrows |
| U+2191 | ↑ | ↑ | ↑ | "\2191" | Arrows |
| U+2192 | → | → | → | "\2192" | Arrows |
| U+2193 | ↓ | ↓ | ↓ | "\2193" | Arrows |
| U+2194 | ↔ | ↔ | ↔ | "\2194" | Arrows |
| U+21D0 | ⇐ | ⇐ | ⇐ | "\21D0" | Arrows |
| U+21D2 | ⇒ | ⇒ | ⇒ | "\21D2" | Arrows |
| U+21D4 | ⇔ | ⇔ | ⇔ | "\21D4" | Arrows |
| U+21B5 | ↵ | ↵ | ↵ | "\21B5" | Arrows |
| U+00A9 | © | © | © | "\A9" | Symbols |
| U+00AE | ® | ® | ® | "\AE" | Symbols |
| U+2122 | ™ | ™ | ™ | "\2122" | Symbols |
| U+2713 | ✓ | ✓ | ✓ | "\2713" | Symbols |
| U+2717 | ✗ | ✗ | ✗ | "\2717" | Symbols |
| U+2605 | ★ | ★ | ★ | "\2605" | Symbols |
| U+2606 | ☆ | ☆ | ☆ | "\2606" | Symbols |
| U+2665 | ♥ | ♥ | ♥ | "\2665" | Symbols |
| U+2660 | ♠ | ♠ | ♠ | "\2660" | Symbols |
| U+2663 | ♣ | ♣ | ♣ | "\2663" | Symbols |
| U+2666 | ♦ | ♦ | ♦ | "\2666" | Symbols |
| U+260E | ☎ | ☎ | ☎ | "\260E" | Symbols |
| U+2640 | ♀ | ♀ | ♀ | "\2640" | Symbols |
| U+2642 | ♂ | ♂ | ♂ | "\2642" | Symbols |
| U+25CA | ◊ | ◊ | ◊ | "\25CA" | Symbols |
| U+03B1 | α | α | α | "\3B1" | Greek |
| U+03B2 | β | β | β | "\3B2" | Greek |
| U+03B3 | γ | γ | γ | "\3B3" | Greek |
| U+03B4 | δ | δ | δ | "\3B4" | Greek |
| U+03C0 | π | π | π | "\3C0" | Greek |
| U+03BC | μ | μ | μ | "\3BC" | Greek |
| U+03C3 | σ | σ | σ | "\3C3" | Greek |
| U+03BB | λ | λ | λ | "\3BB" | Greek |
| U+03A9 | Ω | Ω | Ω | "\3A9" | Greek |
| U+0394 | Δ | Δ | Δ | "\394" | Greek |
| U+1F600 | (no name) | 😀 | 😀 | "\1F600" | Emoji |
| U+1F44D | (no name) | 👍 | 👍 | "\1F44D" | Emoji |
| U+2764 | (no name) | ❤ | ❤ | "\2764" | Emoji |
| U+1F680 | (no name) | 🚀 | 🚀 | "\1F680" | Emoji |
| U+2705 | (no name) | ✅ | ✅ | "\2705" | Emoji |
| U+1F525 | (no name) | 🔥 | 🔥 | "\1F525" | Emoji |
| U+1F4E7 | (no name) | 📧 | 📧 | "\1F4E7" | Emoji |
| U+1F4CD | (no name) | 📍 | 📍 | "\1F4CD" | Emoji |
An HTML parser reads < as the start of a tag and & as the start of a character reference. If a product name or a code sample contains those characters, the browser may hide part of the text, merge it with the next tag, or in the worst case run injected markup. Escaping them tells the parser to show the character instead of acting on it.
The rule of thumb: escape &, < and > in text, and also escape the quote character inside attribute values. Everything else is a matter of convenience or encoding.
HTML entities only work in HTML. In a stylesheet, a character is written as a backslash followed by its hex code, which is why the table gives a CSS column for pseudo-element icons and custom bullets. In JavaScript strings the equivalent is \u followed by four hex digits, or \u{...} for characters beyond U+FFFF such as emoji.
If you set text with textContent in JavaScript, never escape it first: the browser treats it as plain text already, and escaping would show the entity literally.
Both produce the same character. A named reference like © is easier to read; a numeric one like © (decimal) or © (hex) works for every Unicode character, including the many that have no name. HTML defines about 2,200 names.
Only for the characters that have a meaning in markup: &, < and, inside attributes, the quote you used. With a UTF-8 page you can type symbols such as €, é or → directly. Entities for those are optional and mostly help when an editor or email system mangles non-ASCII text.
Yes, in HTML5. It was missing from HTML 4, which is why older code uses ' instead. Both work in every current browser, and the escape option on this page outputs ' for the widest compatibility.
It stops injected text from becoming markup in normal element content and quoted attributes. It does not make a value safe inside a script block, an inline event handler, a style attribute or a URL such as href, which each need their own encoding or validation. Use your framework's built-in escaping and avoid building HTML from strings where you can.
No. Escaping and unescaping run in your browser, and nothing you paste leaves the page.
Related: URL encoder and decoder, URL parser, Markdown to HTML converter, HTML comments, line breaks and spaces, HTML viewer.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.